Live › vulnerability › CVE-2022-39366
Go to dashboardDataHub's metadata service parses JWT tokens without checking their cryptographic signature, so any token is accepted regardless of algorithm. An attacker can forge a token and connect to the instance as any user when Metadata Service authentication is enabled.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 20:56 UTC, 0h before NVD. All times on this page are UTC.
Teams running a self-hosted DataHub metadata service with Metadata Service authentication enabled are exposed, since the flaw is in the server-side token check. Instances with authentication disabled are not exposed by this flaw, as the sources describe it as an authentication bypass. Teams using only the client library without running a metadata service are unlikely to be affected, though the sources do not state this explicitly.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| acryl-datahub | pypi | < 0.8.45 | 0.8.45 |
| datahub | vendor | < 0.8.45 | 0.8.45 |
pip show acryl-datahub; versions below 0.8.45 are affected.acryl-datahub package to 0.8.45 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
GHSL-2022-078)The StatelessTokenService of the DataHub metadata service (GMS) does not verify the signature of JWT tokens. This allows an attacker to connect to DataHub instances as any user if Metadata Service authentication is enabled. This vulnerability occurs because the StatelessTokenService of the Metadata service uses the parse method of io.jsonwebtoken.JwtParser, which does not perform a verification of the cryptographic token signature. This means that JWTs are accepted regardless of the used algorithm.
This issue may lead to an authentication bypass.
This page as .md · .json · in your agent: get_signal("CVE-2022-39366")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.